Threat Intelligence

12/6/2018
04:15 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Adobe Flash Zero-Day Spreads via Office Docs

Adobe has patched a zero-day in its Flash player after attackers leveraged the exploit in an active campaign.

An Adobe Flash zero-day was seen in the wild as part of an active campaign using the exploit in Microsoft Office documents. Adobe has since patched the vulnerability, CVE-2018-15982.

Gigamon's Applied Threat Research (ATR) team identified the active campaign, which uses malicious files to deliver the exploit. CVE-2018-15982 lets a Flash object execute code on a target machine and enables an attacker to gain command line access to the victim's system.

The document used in this campaign, "22.docx," was submitted by a Ukrainian IP address to VirusTotal. It appears to be an application for a Russian state healthcare clinic; the logo indicates it's a fake application for "Polyclinic No. 2," an adult outpatient clinic located in Moscow. Analysts compared the logo in the doc to the clinic's authentic logo.

The file contains seven pages of personal questions typical of an employment application, requesting the recipient's full name, birthdate, profession, company division, and level of skill.

"It's indicative of a targeted spear-phishing attack, presumably things the receiver would be familiar with," says Josh Carlson, vice president of threat research at Gigamon. The way the document is crafted suggests its recipients would recognize the clinic's name and logo. While this type of phishing lure appears to be highly targeted, ATR researchers point out the team has observed other similar spear-phishing attacks in which lures are unrelated to their recipients.

It's hard to tell for sure because ATR doesn't have specifics on the extent of this campaign or number of people affected. Carlson suggests this is either a highly targeted attack, in which the actor(s) has substantial knowledge of the victim's environment, or the actor is testing his tools.

A Closer Look at the Attack
The way this attack unfolds is simple: The document's header contains an Active X control, which renders when the file is opened and causes an exploitation of Flash within Office. The exploitation leads to the execution of a malicious command, which attempts to extract and execute a payload, researchers explain in a blog post on their discovery.

In this case, the Flash exploit is self-encapsulated within the document and supports 32- and 64-bit systems. The Flash file and shellcode stubs don't make use of remote inclusion, staging, obfuscation, or any kind of anti-analysis, researchers say. Both shellcode stubs execute the same command, which is consistent with an attack packaged as a RAR archive. Testing shows that opening the document within the archive is enough to run the exploit and payload.

(Image: Kaspars Grinvalds - stock.adobe.com)

(Image: Kaspars Grinvalds stock.adobe.com)

There isn't much that's unique about this campaign, Carlson says, but what's strange is it requires targets to take several steps to open the document and execute the command.

"It's unusual in that they have a zero-day in Flash, but they're requesting users to go through extra clicks and follow steps to leverage it," he explains.

Analysts have moderate to high confidence the payload is a variant of Scout malware, based on similarity in submission details, behavior, close time proximity, and file name matching the one expected by the exploit. The payload, a Windows executable file, is protected with VMProtect, which prevents reverse engineering and analysis. The payload collects system data, establishes persistence, and communicates with a remote server via HTTP post.

The techniques of this campaign are similar to those used by HackingTeam, an Italian offensive security company selling remote access-as-a-service and surveillance tools. When HackingTeam was breached in 2015, its internal data, including email and source code for backdoors and exploits, was publicly spread. Cyberattackers around the world began using HackingTeam's tools to launch operations. This could be the case here, but attribution is difficult, ATR says.

"There are similarities to HackingTeam, but in reality those tools have been reused by many copycats," Carlson says.

Flash Stays Alive…. For Now
The death of Flash is a common topic in cybersecurity as efforts aim to remove Flash from Web browsers. Cybercriminals, however, will continue to use it. They're just finding new ways. Vectors like Microsoft Office can still load and execute Flash content, and exploits against zero-days that allow for command execution using popular enterprise software will prove valuable.

"As Flash is less used in browsers, the attackers are moving toward Office as an attack vector," Carlson explains. Flash is going to become less of an attack surface over time, but it still works, he says.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-18913
PUBLISHED: 2019-03-21
Opera before 57.0.3098.106 is vulnerable to a DLL Search Order hijacking attack where an attacker can send a ZIP archive composed of an HTML page along with a malicious DLL to the target. Once the document is opened, it may allow the attacker to take full control of the system from any location with...
CVE-2018-20031
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to preemptive item deletion in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor ...
CVE-2018-20032
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to message decoding in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor daemon t...
CVE-2018-20034
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to adding an item to a list in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor ...
CVE-2019-3855
PUBLISHED: 2019-03-21
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.